What Burp does is intercepting a request and allowing the user/pentester to modify it. Technically it acts as a proxy, allowing the user to send pretty much arbitrary input to your application (server-side).

You seem to assume, that requests can only be sent using your app. This is not true and generally pretty dangerous to rely on. Keep in mind, that everybody can do a "Bash-Fu-1-Liner" using cURL and send literally **anything** to your server. Your webservice **has to be prepared for that**! If the only input checks you perform are client-side (which is untrusted code as users can mess with it), you have to overthink your security measures.

Separate client-side and server-side. Think of them as two pieces of software which have to be secure on their own.